GitHub Advisoryadvisory · npm

GHSA-6vj3-p34w-xxjp apidoc-core has a prototype pollution vulnerability

CRITICAL Published 2025-12-26 Modified 2025-12-26 Official page ↗
Aliases
CVE-2025-13158
Ecosystem
npm
Packages
apidoc-core
Severity
Critical
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-1321
Reviewed
2025-12-26

Affected packages

• npm apidoc-core: >= 0.2.0, <= 0.15.0 (no fix yet)

Description

Prototype pollution vulnerability in apidoc-core versions 0.2.0 and all subsequent versions allows remote attackers to modify JavaScript object prototypes via malformed data structures, including the “define” property processed by the application, potentially leading to denial of service or unintended behavior in applications relying on the integrity of prototype chains. This affects the preProcess() function in api_group.js, api_param_title.js, api_use.js, and api_permission.js worker modules.

Related

Alias · CVE (1)

  • CVE-2025-13158 Prototype pollution vulnerability in apidoc-core versions 0.2.0 and all subsequent versions allows remote attackers to modify JavaScript… vulnerability

Weakness · CWE (1)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness

References